C1: SIGSEGV in SubstitutionResolver::visit

The following test failed in the JDK16 CI:

compiler/rangechecks/TestRangeCheckSmearingLoopOpts.java

Here's a snippet from the log file:

#section:main
----------messages:(4/341)----------
command: main -XX:-BackgroundCompilation -XX:-UseOnStackReplacement compiler.rangechecks.TestRangeCheckSmearingLoopOpts
reason: User specified action: run main/othervm -XX:-BackgroundCompilation -XX:-UseOnStackReplacement compiler.rangechecks.TestRangeCheckSmearingLoopOpts
Mode: othervm [/othervm specified]
elapsed time (seconds): 10.209
----------configuration:(0/0)----------
----------System.out:(21/1454)----------
#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x000000010e950954, pid=31532, tid=24579
#
# JRE version: Java(TM) SE Runtime Environment (16.0+14) (fastdebug build 16-ea+14-559)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 16-ea+14-559, mixed mode, sharing, tiered, jvmci, jvmci compiler, compressed oops, g1 gc, bsd-amd64)
# Problematic frame:
# V [libjvm.dylib+0x350954] non-virtual thunk to SubstitutionResolver::visit(Instruction**)+0x4
#
# Core dump will be written. Default location: core.31532
#
# An error report file with more information is saved as:
# /System/Volumes/Data/mesos/work_dir/slaves/4076d11c-c6ed-4d07-84c1-4ab8d55cd975-S47664/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/a3e777ee-00dc-4ff7-9e6d-610739ba61b3/runs/ab61e883-3d86-4d28-a606-50c6cf984117/testoutput/test-support/jtreg_open_test_hotspot_jtreg_hotspot_not_fast_compiler/scratch/4/hs_err_pid31532.log
#
# Compiler replay data is saved as:
# /System/Volumes/Data/mesos/work_dir/slaves/4076d11c-c6ed-4d07-84c1-4ab8d55cd975-S47664/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/a3e777ee-00dc-4ff7-9e6d-610739ba61b3/runs/ab61e883-3d86-4d28-a606-50c6cf984117/testoutput/test-support/jtreg_open_test_hotspot_jtreg_hotspot_not_fast_compiler/scratch/4/replay_pid31532.log
#
# If you would like to submit a bug report, please visit:
# https://bugreport.java.com/bugreport/crash.jsp
#
----------System.err:(0/0)----------
----------rerun:(46/6843)*----------

Here's the crashing thread's stack:

--------------- T H R E A D ---------------

Current thread (0x00007fcb88012a20): JavaThread "C1 CompilerThread0" daemon [_thread_in_native, id=24579, stack(0x000070000d203000,0x000070000d303000)]


Current CompileTask:
C1: 5319 1341 1 org.graalvm.compiler.graph.Node::updatePredecessor (254 bytes)

Stack: [0x000070000d203000,0x000070000d303000], sp=0x000070000d301e10, free space=1019k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V [libjvm.dylib+0x350954] non-virtual thunk to SubstitutionResolver::visit(Instruction**)+0x4
V [libjvm.dylib+0x357b71] Invoke::input_values_do(ValueVisitor*)+0x81
V [libjvm.dylib+0x3509df] SubstitutionResolver::block_do(BlockBegin*)+0x3f
V [libjvm.dylib+0x355720] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0xb0
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x35580a] BlockBegin::iterate_preorder(GrowableArray<bool>&, BlockClosure*)+0x19a
V [libjvm.dylib+0x355a3c] BlockBegin::iterate_preorder(BlockClosure*)+0x4c
V [libjvm.dylib+0x3d2ca8] Optimizer::eliminate_conditional_expressions()+0x68
V [libjvm.dylib+0x34b7f7] IR::optimize_blocks()+0x67
V [libjvm.dylib+0x31c5f7] Compilation::build_hir()+0x237
V [libjvm.dylib+0x31dab2] Compilation::compile_java_method()+0x182
V [libjvm.dylib+0x31dfb8] Compilation::compile_method()+0xb8
V [libjvm.dylib+0x31e337] Compilation::Compilation(AbstractCompiler*, ciEnv*, ciMethod*, int, BufferBlob*, bool, DirectiveSet*)+0x297
V [libjvm.dylib+0x32077c] Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x16c
V [libjvm.dylib+0x52e858] CompileBroker::invoke_compiler_on_method(CompileTask*)+0x5f8
V [libjvm.dylib+0x52dff6] CompileBroker::compiler_thread_loop()+0x2e6
V [libjvm.dylib+0xfedcb1] JavaThread::thread_main_inner()+0x2c1
V [libjvm.dylib+0xfe8e97] Thread::call_run()+0x1b7
V [libjvm.dylib+0xdad53f] thread_native_entry(Thread*)+0x15f
C [libsystem_pthread.dylib+0x6109] _pthread_start+0x94
C [libsystem_pthread.dylib+0x1b8b] thread_start+0xf


siginfo: si_signo: 11 (SIGSEGV), si_code: 1 (SEGV_MAPERR), si_addr: 0x00006fcb082e2270